# SCALM: Detecting Bad Practices in Smart Contracts Through LLMs

arXiv: https://arxiv.org/abs/2502.04347 · HTML: https://mlsanity.com/paper/2502.04347/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 49 references that are in the map.
- First posted on arXiv 4 Feb 2025.

## Builds on (most cited first, 21 of 21)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [GLM: General Language Model Pretraining with Autoregressive Blank Infilling](https://mlsanity.com/paper/2103.10360/) (2021)
- [Slither: A Static Analysis Framework For Smart Contracts](https://mlsanity.com/paper/1908.09878/) (2019)
- [Securify: Practical Security Analysis of Smart Contracts](https://mlsanity.com/paper/1806.01143/) (2018)
- [When ChatGPT Meets Smart Contract Vulnerability Detection: How Far Are We?](https://mlsanity.com/paper/2309.05520/) (2023)
- [PropertyGPT: LLM-driven Formal Verification of Smart Contracts through Retrieval-Augmented Property Generation](https://mlsanity.com/paper/2405.02580/) (2024)
- [Empirical Review of Automated Analysis Tools on 47,587 Ethereum Smart Contracts](https://mlsanity.com/paper/1910.10601/) (2019)
- [Vandal: A Scalable Security Analysis Framework for Smart Contracts](https://mlsanity.com/paper/1809.03981/) (2018)
- [Efficient Avoidance of Vulnerabilities in Auto-completed Smart Contract Code Using Vulnerability-constrained Decoding](https://mlsanity.com/paper/2309.09826/) (2023)
- [Deep Lake: a Lakehouse for Deep Learning](https://mlsanity.com/paper/2209.10785/) (2022)
- [eThor: Practical and Provably Sound Static Analysis of Ethereum Smart Contracts](https://mlsanity.com/paper/2005.06227/) (2020)
- [Harvey: A Greybox Fuzzer for Smart Contracts](https://mlsanity.com/paper/1905.06944/) (2019)
- [DAppSCAN: Building Large-Scale Datasets for Smart Contract Weaknesses in DApp Projects](https://mlsanity.com/paper/2305.08456/) (2023)
- [AuditGPT: Auditing Smart Contracts with ChatGPT](https://mlsanity.com/paper/2404.04306/) (2024)
- [Smart Contract and DeFi Security Tools: Do They Meet the Needs of Practitioners?](https://mlsanity.com/paper/2304.02981/) (2023)
- [Unveiling Wash Trading in Popular NFT Markets](https://mlsanity.com/paper/2403.10361/) (2024)
- [StateGuard: Detecting State Derailment Defects in Decentralized Exchange Smart Contract](https://mlsanity.com/paper/2405.09181/) (2024)
- [Improving Smart Contract Security with Contrastive Learning-based Vulnerability Detection](https://mlsanity.com/paper/2404.17839/) (2024)
- [DeFiTail: DeFi Protocol Inspection through Cross-Contract Execution Analysis](https://mlsanity.com/paper/2405.11035/) (2024)
- [Characterizing Erasable Accounts in Ethereum](https://mlsanity.com/paper/2009.00607/) (2020)
- [An Overview of AI and Blockchain Integration for Privacy-Preserving](https://mlsanity.com/paper/2305.03928/) (2023)

## Built on by (most cited first, 8 of 8)

- [SoK: Security and Privacy of AI Agents for Blockchain](https://mlsanity.com/paper/2509.07131/) (2025)
- [InfiCoEvalChain: A Blockchain-Based Decentralized Framework for Collaborative LLM Evaluation](https://mlsanity.com/paper/2602.08229/) (2026)
- [AI-Based Vulnerability Analysis of NFT Smart Contracts](https://mlsanity.com/paper/2504.16113/) (2025)
- [A Comprehensive Study of Exploitable Patterns in Smart Contracts: From Vulnerability to Defense](https://mlsanity.com/paper/2504.21480/) (2025)
- [TxSum: User-Centered Ethereum Transaction Understanding with Micro-Level Semantic Grounding](https://mlsanity.com/paper/2512.06933/) (2025)
- [Facial Recognition Leveraging Generative Adversarial Networks](https://mlsanity.com/paper/2505.11884/) (2025)
- [Robust Smart Contract Vulnerability Detection via Contrastive Learning-Enhanced Granular-ball Training](https://mlsanity.com/paper/2603.27734/) (2026)
- [ORACAL: A Robust and Explainable Multimodal Framework for Smart Contract Vulnerability Detection with Causal Graph Enrichment](https://mlsanity.com/paper/2603.28128/) (2026)

## Abstract (arXiv)

As the Ethereum platform continues to mature and gain widespread usage, it is crucial to maintain high standards of smart contract writing practices. While bad practices in smart contracts may not directly lead to security issues, they do elevate the risk of encountering problems. Therefore, to understand and avoid these bad practices, this paper introduces the first systematic study of bad practices in smart contracts, delving into over 35 specific issues. Specifically, we propose a large language models (LLMs)-based framework, SCALM. It combines Step-Back Prompting and Retrieval-Augmented Generation (RAG) to identify and address various bad practices effectively. Our extensive experiments using multiple LLMs and datasets have shown that SCALM outperforms existing tools in detecting bad practices in smart contracts.